Bazilion 0.13.0 delivers the security-focused protected runtime release.
Highlights:
- Credential-minimal protected execution for Telegram and autonomous Agent work, with fail-closed Docker isolation and authenticated owner pairing.
- A loopback-only private web gateway with Tailscale Serve preflight, expiring device credentials, bounded browser sessions, CSRF protection, and strict origin policy.
- Recipient-encrypted age backups, authenticated staged restore, bootstrap rotation, and explicit credential recovery guidance.
- A deterministic 60-case adversarial security acceptance gate.
- Protected and restricted-review worker support across the complete pinned Pi provider catalog.
- Pi agent engine 0.84.3 with refreshed providers and model examples.
Validation:
pnpm typecheckpassed.- Full Vitest suite passed: 131 files passed, 1 skipped; 1,108 tests passed, 3 skipped.
- Web typecheck and production build passed.
- Security acceptance gate passed all 60 cases.